Windows: dsacls.exe used to grant potentially over-permissive access rights

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions of dsacls.exe where the command line includes /G and permission tokens such as GR, GE, GW, GA, WP, or WD. Granting broad or high-privilege rights can enable privilege escalation and stealthy access persistence. The detection relies on Windows process creation telemetry, specifically the image name and command-line content.

Reporting behind it

Related detections9 linkedT1218 — drag to rearrange

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

Malicious DLL Execution via Wuauclt Update Handler (via process_creation)

Malicious aspnet_compiler.exe Injection Host Spawned by PowerShell via process_creation

Malicious regsvcs LOLBin Loading Ransomware DLL from UNC Path

Suspicious RegAsm or RegSvcs Spawned by Script Host (via process_creation)

Suspicious Extexport DLL Side-Loading Execution

Malicious ClickFix Execution Chain Spawning MSHTA via Pcalua on EtherRAT Infection

Suspicious TALONITE Certutil LOLBIN Decode and Download Abuse (via process_creation)

Suspicious Renamed git Binary gcmd.exe Execution (via process_creation)

Windows: dsacls.exe used to grant potentially over-permissive access rights

Pivot detection · T1218 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-dsacls-exe-granting-over-permissive-acl-permissions-via-g-01c42d3c

title: "Windows: dsacls.exe used to grant potentially over-permissive access rights"
id: e3e3be2d-6fa5-4b0a-8eec-8ceb5612eca0
status: test
description: This rule flags process executions of dsacls.exe where the command line includes /G and permission tokens such as GR, GE, GW, GA, WP, or WD. Granting broad or high-privilege rights can enable privilege escalation and stealthy access persistence. The detection relies on Windows process creation telemetry, specifically the image name and command-line content.
references:
  - https://ss64.com/nt/dsacls.html
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771151(v=ws.11)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dsacls_abuse_permissions.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-20
modified: 2023-02-04
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \dsacls.exe
    - OriginalFileName: DSACLS.EXE
  selection_flag:
    CommandLine|contains: " /G "
  selection_permissions:
    CommandLine|contains:
      - GR
      - GE
      - GW
      - GA
      - WP
      - WD
  condition: all of selection_*
falsepositives:
  - Legitimate administrators granting over permissive permissions to users
level: medium
license: DRL-1.1
related:
  - id: 01c42d3c-242d-4655-85b2-34f1739632f7
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL